Skip to content

[EDMT-454] Docker 엔트리포인트 JAVA_OPTS 설정 개선 #74

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kgy1008 merged 4 commits into from
Sep 25, 2025
Merged

[EDMT-454] Docker 엔트리포인트 JAVA_OPTS 설정 개선 #74

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
58cd3e6
[fix] update entrypoint to use JAVA_OPTS in Docker configuration
kgy1008 Sep 21, 2025
20d25c7
[fix] update Docker entrypoint to use JAVA_OPTS for better configurat…
kgy1008 Sep 21, 2025
7e61716
[refac] escape JAVA_OPTS in Docker entrypoint for proper variable exp…
kgy1008 Sep 21, 2025
3a7115c
[fix] remove JMX agent configuration from Docker compose files
kgy1008 Sep 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile-dev
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM eclipse-temurin:21-jdk-alpine
ARG JAR_FILE=build/libs/edukit-api.jar
COPY ${JAR_FILE} app.jar
ENTRYPOINT ["java", "-Duser.timezone=Asia/Seoul", "-Dspring.profiles.active=dev", "-jar", "/app.jar"]
ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=dev -jar /app.jar"]
2 changes: 1 addition & 1 deletion Dockerfile-prod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM eclipse-temurin:21-jdk-alpine
ARG JAR_FILE=build/libs/edukit-api.jar
COPY ${JAR_FILE} app.jar
ENTRYPOINT ["java", "-Duser.timezone=Asia/Seoul", "-Dspring.profiles.active=prod", "-jar", "/app.jar"]
ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=prod -jar /app.jar"]
Copy link

@coderabbitai coderabbitai bot Sep 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

❓ Verification inconclusive

프로덕션 이미지에서의 sh -c는 보안/신호 전달 리스크 — exec 추가 또는 JAVA_TOOL_OPTIONS로 전환 필요

  • 프로덕션에서는 쉘 인젝션과 PID 1 문제의 영향이 더 큼.
  • 최소 변경:
-ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=prod -jar /app.jar"]
+ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=prod -jar /app.jar"]
  • 권장 대안:
-ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=prod -jar /app.jar"]
+ENTRYPOINT ["java", "-Duser.timezone=Asia/Seoul", "-Dspring.profiles.active=prod", "-jar", "/app.jar"]
  • 운영 환경에서는 JAVA_TOOL_OPTIONS로 옵션을 주입해 쉘을 제거하는 구성을 권장합니다.

프로덕션 Dockerfile: ENTRYPOINT에서 sh -c 제거 — 신호 전달·쉘 인젝션 위험 (긴급 수정 필요)

sh -c 사용 시 PID 1로서 SIGTERM/SIGINT 등이 자식 JVM으로 직접 전달되지 않으며, $JAVA_OPTS 같은 환경변수 확장으로 쉘 인젝션 위험이 있음.

최소 변경(신호 전달 보장):

-ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=prod -jar /app.jar"]
+ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=prod -jar /app.jar"]

권장(쉘 제거 — 안전·명시적 인수 전달):

-ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=prod -jar /app.jar"]
+ENTRYPOINT ["java", "-Duser.timezone=Asia/Seoul", "-Dspring.profiles.active=prod", "-jar", "/app.jar"]

운영 권장: 옵션은 JAVA_TOOL_OPTIONS로 주입하여 쉘을 제거한 exec 형식으로 실행. 파일: Dockerfile-prod (라인 4)

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=prod -jar /app.jar"]
ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=prod -jar /app.jar"]
Suggested change
ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=prod -jar /app.jar"]
ENTRYPOINT ["java", "-Duser.timezone=Asia/Seoul", "-Dspring.profiles.active=prod", "-jar", "/app.jar"]
🤖 Prompt for AI Agents 
Dockerfile-prod around line 4: the current ENTRYPOINT uses sh -c which breaks
signal forwarding and allows shell-injection via $JAVA_OPTS; change to an
exec-form ENTRYPOINT that invokes the JVM directly (no sh -c) and stop expanding
untrusted vars in the shell — pass JVM options via the standard
JAVA_TOOL_OPTIONS environment variable or as explicit JSON-array arguments so
signals (SIGTERM/SIGINT) are forwarded to the JVM and no shell interpolation
occurs; minimally replace the shell form with an exec-form ENTRYPOINT that calls
java with the timezone, profile and -jar arguments, and optionally set or
document use of JAVA_TOOL_OPTIONS for additional options.

10 changes: 2 additions & 8 deletions docker-compose.dev.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,19 +6,16 @@ services:
PROFILE: dev
TZ: Asia/Seoul
HOSTNAME: ${HOSTNAME_BLUE:-dev-1-blue}
JAVA_OPTS: "-javaagent:/app/jmx_prometheus_javaagent.jar=9081:/app/jmx-config.yml"
ports:
- "8080:8080"
- "9081:9081"
env_file:
- .env
restart: always
volumes:
- ./log/blue:/log
- /opt/jmx_prometheus_javaagent.jar:/app/jmx_prometheus_javaagent.jar
- ./jmx-config.yml:/app/jmx-config.yml
networks:
- app-network
entrypoint: ["sh", "-c", "java $$JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=dev -jar /app.jar"]
Copy link

@coderabbitai coderabbitai bot Sep 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

dev 환경도 동일하게 exec 적용 필요

dev compose 역시 sh -c로 인해 PID 1/signal 문제와 JAVA_OPTS 해석 문제가 동일하게 발생합니다. prod와 동일한 방식으로 exec를 추가해 주세요.

-    entrypoint: ["sh", "-c", "java $$JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=dev -jar /app.jar"]
+    entrypoint: ["sh", "-c", "exec java $$JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=dev -jar /app.jar"]

Also applies to: 36-36

🤖 Prompt for AI Agents 
In docker-compose.dev.yml around lines 18 and 36, the entrypoint currently uses
sh -c which causes PID 1/signal forwarding and JAVA_OPTS expansion issues;
update both entrypoint definitions to use exec so the JVM runs as PID 1 and
signals are forwarded and environment expansion works — change the command
string to include exec before java (e.g., keep the existing shell wrapper but
use "sh", "-c", "exec java $$JAVA_OPTS -Duser.timezone=Asia/Seoul
-Dspring.profiles.active=dev -jar /app.jar" or the equivalent for the other
occurrence) so the shell replaces itself with the java process.


app-green:
container_name: app-green
Expand All @@ -27,19 +24,16 @@ services:
PROFILE: dev
TZ: Asia/Seoul
HOSTNAME: ${HOSTNAME_GREEN:-dev-1-green}
JAVA_OPTS: "-javaagent:/app/jmx_prometheus_javaagent.jar=9082:/app/jmx-config.yml"
ports:
- "8081:8080"
- "9082:9082"
env_file:
- .env
restart: always
volumes:
- ./log/green:/log
- /opt/jmx_prometheus_javaagent.jar:/app/jmx_prometheus_javaagent.jar
- ./jmx-config.yml:/app/jmx-config.yml
networks:
- app-network
entrypoint: ["sh", "-c", "java $$JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=dev -jar /app.jar"]
Copy link

@coderabbitai coderabbitai bot Sep 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

🧩 Analysis chain

app-green도 동일 이슈 — 동일한 수정 적용 필요

아래와 같이 exec 추가 또는 JAVA_TOOL_OPTIONS 전환을 권장합니다.

-    entrypoint: ["sh", "-c", "java $$JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=dev -jar /app.jar"]
+    entrypoint: ["sh", "-c", "exec java $$JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=dev -jar /app.jar"]

app-green 서비스의 entrypoint 동일 여부 확인을 위해 아래 명령어 실행합니다.

🏁 Script executed:

#!/bin/bash
rg -n "entrypoint" -C3 docker-compose.dev.yml

Length of output: 520

app-green 서비스에도 exec 적용 필요
docker-compose.dev.yml의 44번째 줄 entrypoint를 아래와 같이 수정하세요:

-    entrypoint: ["sh", "-c", "java $$JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=dev -jar /app.jar"]
+    entrypoint: ["sh", "-c", "exec java $$JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=dev -jar /app.jar"]
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
entrypoint: ["sh", "-c", "java $$JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=dev -jar /app.jar"]
entrypoint: ["sh", "-c", "exec java $$JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=dev -jar /app.jar"]
🤖 Prompt for AI Agents 
In docker-compose.dev.yml around line 44, the app-green service entrypoint needs
to use exec so the Java process replaces the shell; update the entrypoint to run
the shell with exec before java (e.g., ["sh","-c","exec java $JAVA_OPTS
-Duser.timezone=Asia/Seoul -Dspring.profiles.active=dev -jar /app.jar"]) so
signals are forwarded correctly and the shell no longer becomes the main
process.


nginx:
container_name: nginx
Expand Down
10 changes: 2 additions & 8 deletions docker-compose.prod.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,19 +6,16 @@ services:
PROFILE: prod
TZ: Asia/Seoul
HOSTNAME: ${HOSTNAME_BLUE:-prod-1-blue}
JAVA_OPTS: "-javaagent:/app/jmx_prometheus_javaagent.jar=9081:/app/jmx-config.yml"
ports:
- "8080:8080"
- "9081:9081"
env_file:
- .env
restart: always
volumes:
- ./log/blue:/log
- /opt/jmx_prometheus_javaagent.jar:/app/jmx_prometheus_javaagent.jar
- ./jmx-config.yml:/app/jmx-config.yml
networks:
- app-network
entrypoint: ["sh", "-c", "java $$JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=prod -jar /app.jar"]
Copy link

@coderabbitai coderabbitai bot Sep 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

쉘 entrypoint로 인한 신호 전달 및 명령 인젝션 위험 수정 필요

현재 sh -c "java $$JAVA_OPTS …" 형태는 셸이 PID 1로 남아 SIGTERM 등이 JVM까지 전달되지 않을 수 있고, $$JAVA_OPTS가 셸에서 그대로 해석되어 명령 인젝션 위험도 존재합니다. 최소한 exec를 추가해 셸이 자신을 Java 프로세스로 교체하도록 해 주세요.

-    entrypoint: ["sh", "-c", "java $$JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=prod -jar /app.jar"]
+    entrypoint: ["sh", "-c", "exec java $$JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=prod -jar /app.jar"]

Also applies to: 36-36

🤖 Prompt for AI Agents 
In docker-compose.prod.yml around lines 18 and 36, the entrypoint uses a shell
form that leaves a shell as PID 1 and uses an unsafe variable expansion
(\"$$JAVA_OPTS\") which risks broken signal propagation and command injection;
update the entrypoints to run the Java process as PID 1 by prepending exec and
stop using the literal $$ expansion — use a shell invocation that calls exec and
a properly quoted environment variable (e.g., sh -c 'exec java "$JAVA_OPTS"
-Duser.timezone=Asia/Seoul -Dspring.profiles.active=prod -jar /app.jar') or,
preferably, move options into explicit args so the Java binary is launched
directly without an intermediate shell.


app-green:
container_name: app-green
Expand All @@ -27,19 +24,16 @@ services:
PROFILE: prod
TZ: Asia/Seoul
HOSTNAME: ${HOSTNAME_GREEN:-prod-1-green}
JAVA_OPTS: "-javaagent:/app/jmx_prometheus_javaagent.jar=9082:/app/jmx-config.yml"
ports:
- "8081:8080"
- "9082:9082"
env_file:
- .env
restart: always
volumes:
- ./log/green:/log
- /opt/jmx_prometheus_javaagent.jar:/app/jmx_prometheus_javaagent.jar
- ./jmx-config.yml:/app/jmx-config.yml
networks:
- app-network
entrypoint: ["sh", "-c", "java $$JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=prod -jar /app.jar"]
Copy link

@coderabbitai coderabbitai bot Sep 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

❓ Verification inconclusive

prod app-green: 동일 수정 적용 필요

다음과 같이 exec 추가 또는 JAVA_TOOL_OPTIONS 전환을 적용해 주세요.

-    entrypoint: ["sh", "-c", "java $$JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=prod -jar /app.jar"]
+    entrypoint: ["sh", "-c", "exec java $$JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=prod -jar /app.jar"]

prod app-green: entrypoint에 exec 추가 필요

sh -c로 java를 실행하면 PID 1이 쉘이 되어 시그널 전달·종료 처리 문제가 발생할 수 있습니다. exec로 대체하세요.
파일: docker-compose.prod.yml (라인 44)

-    entrypoint: ["sh", "-c", "java $$JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=prod -jar /app.jar"]
+    entrypoint: ["sh", "-c", "exec java $$JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=prod -jar /app.jar"]
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
entrypoint: ["sh", "-c", "java $$JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=prod -jar /app.jar"]
entrypoint: ["sh", "-c", "exec java $$JAVA_OPTS -Duser.timezone=Asia/Seoul -Dspring.profiles.active=prod -jar /app.jar"]
🤖 Prompt for AI Agents 
In docker-compose.prod.yml around line 44, the entrypoint currently runs java
via sh -c which leaves the shell as PID 1 and prevents proper signal
propagation; update the entrypoint to invoke exec within the sh -c command so
the java process replaces the shell (e.g., use sh -c "exec java ..."),
preserving the existing JVM options and environment variable escaping.


nginx:
container_name: nginx
Expand Down
72 changes: 0 additions & 72 deletions jmx-config.yml
View file
Open in desktop

This file was deleted.